General
-
Target
launcher.exe
-
Size
2.7MB
-
Sample
241212-gzzd2axlhq
-
MD5
412d3d31bc2e7944c65d5d06006337c7
-
SHA1
ee0bc9b5dafb5cdb1b26105de453c56f18ca3dd7
-
SHA256
9ab3cbe05be213d922baf562f6c06efc3fffc177155cc9129e85dcc2b49e1943
-
SHA512
d882a68eba71acbaa0f0df88bb0260c8c079aa2c20839c64789695b8337a76f7e50a292beb933dbec2fa4e9e4b25302fd6e560eddc23afc4de4138102c51ddbe
-
SSDEEP
49152:13fPExpyTgV6j7JHBatLHN8KxTOe63UQmlmwszyZ1:+tWUQ8l
Static task
static1
Behavioral task
behavioral1
Sample
launcher.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
launcher.exe
Resource
win10ltsc2021-20241211-en
Malware Config
Extracted
meduza
193.3.19.151
-
anti_dbg
true
-
anti_vm
true
-
build_name
hdont
-
extensions
.txt
-
grabber_max_size
4.194304e+06
-
port
15666
-
self_destruct
false
Targets
-
-
Target
launcher.exe
-
Size
2.7MB
-
MD5
412d3d31bc2e7944c65d5d06006337c7
-
SHA1
ee0bc9b5dafb5cdb1b26105de453c56f18ca3dd7
-
SHA256
9ab3cbe05be213d922baf562f6c06efc3fffc177155cc9129e85dcc2b49e1943
-
SHA512
d882a68eba71acbaa0f0df88bb0260c8c079aa2c20839c64789695b8337a76f7e50a292beb933dbec2fa4e9e4b25302fd6e560eddc23afc4de4138102c51ddbe
-
SSDEEP
49152:13fPExpyTgV6j7JHBatLHN8KxTOe63UQmlmwszyZ1:+tWUQ8l
-
Meduza Stealer payload
-
Meduza family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-